Privacy Policy

Niva is a skincare guide and skin analysis service created and operated by Ivra Africa Limited, a private limited company incorporated under the laws of the Republic of Kenya and operating globally.

Registered Office: Nairobi, Lower Hill Road, Upper Hill, Duplex Suites · P.O Box 75099, 00200 - City Square

Throughout this policy, “Niva”, “we”, “our”, or “us” refers to Ivra Africa Limited. We act as the Data Controller in respect of the personal data collected through the Niva mobile application, the web application, and the website (www.nivaafrica.com).

For all inquiries concerning data protection, please contact our Data Protection Officer at privacy@nivaafrica.com.

In direct alignment with our Trust & Privacy principles, we collect only the personal information strictly necessary to provide melanin-aware skin analysis, customized product recommendations, and secure account access:

We obtain your explicit, informed consent before processing any facial photo for skin analysis. You retain complete agency over how your data is utilized:

You may revoke or update your consent preferences at any time directly in your account settings or by contacting our team.

We do not sell, rent, or trade your personal data or facial scans to third parties, advertisers, or data brokers.

We engage trusted technical sub-processors solely to perform specialized operational tasks under strict contractual Data Processing Agreements:

• Cloud Infrastructure & Databases: Highly secure cloud hosting providers for encrypted data storage and application runtime.
• Payment Processors: Licensed payment service providers (including Safaricom M-Pesa) for secure payment tokenization.
• Communications: Telecommunication and SMS gateways for OTP phone verification and essential service alerts.
• Brand Partners: When you purchase a product through the Niva marketplace, your delivery details (name, delivery address, phone) are securely shared with the fulfilling brand partner to ship your order.

In accordance with Part VI (Sections 48 and 49) of the Kenya Data Protection Act 2019, where personal data is transferred or stored outside of the Republic of Kenya, Ivra Africa Limited ensures appropriate safeguards are enacted:

• Data is stored in cloud regions with legal frameworks offering equivalent or superior data protection standards.
• Enforced standard contractual clauses and rigorous technical security measures.
• All data is encrypted in transit using industry-standard TLS 1.3 cryptographic protocols.
• All facial vectors and database backups are encrypted at rest using AES-256 encryption.

We retain your personal data only for as long as your Niva account remains active or as needed to maintain your skin history across cycles.

Your right to deletion: You have the absolute right to request the permanent deletion of your account, selfies, scan outputs, and Skin Diary at any time.

To initiate an account or data erasure request, contact us at privacy@nivaafrica.com. Upon verification of your identity, all personal records and raw imagery will be permanently purged within 30 days, subject only to statutory tax or transaction record-keeping duties required by Kenyan law.

Niva is designed for use by persons aged 18 years and above. We do not knowingly process personal data or biometric selfies belonging to individuals under the age of 18 without verifiable parental or legal guardian consent in accordance with Section 33 of the Kenya Data Protection Act 2019.

If we discover that personal data of a minor has been collected without parental consent, we will take immediate steps to delete such data from our databases.

Under Section 26 of the Kenya Data Protection Act 2019, as a data subject you have the following enforceable statutory rights:

• Right to be informed: To be told how your personal data is collected and processed.
• Right of access: To inspect and receive copies of your personal data held by us.
• Right to rectification: To require correction of false, misleading, or outdated personal information.
• Right to erasure: To request deletion of personal data where there is no lawful justification for retention.
• Right to object: To object to processing of personal data for direct marketing or profiling.
• Right to data portability: To receive your data in a structured, commonly used format or have it transmitted to another controller.